Migrate to PHPStan, inline code-quality-pack deps, add Infection & tests

[loevgaard]

Summary

Reworks the dev tooling and test suite while keeping PHP >= 8.1 support.

Keep PHP >= 8.1

• composer.json still requires "php": ">=8.1".
• PHPUnit held at ^10.5 (PHPUnit 11 needs 8.2); Infection pinned to ^0.27 || ^0.28 (0.29+ needs 8.2).
• PHPStan analyzes against the full 8.1–8.4 range (phpVersion.min/max).

Inline latest code-quality-pack deps

• Replaced setono/code-quality-pack with its individual v3.4.0 tools in require-dev: PHPStan + doctrine/symfony/phpunit/strict-rules/webmozart extensions, jangregor/phpstan-prophecy, Rector 2, sylius-labs/coding-standard 4.5, ergebnis/composer-normalize, shipmonk/composer-dependency-analyser, Infection, phpspec/prophecy-phpunit.
• Added phpspec/prophecy directly (the new tests use Prophecy\Argument, flagged by the dependency analyser).

Replace Psalm with PHPStan

• Deleted psalm.xml, added phpstan.neon.dist (level: max, extensions auto-loaded via phpstan/extension-installer).
• Removed all @psalm-suppress annotations and fixed the underlying issues (explicit nullable types, generic phpdoc on the Doctrine event arg, aligned entity metadata types to upstream setono/client v1.1.2).
• One narrow, documented ignore remains for the Symfony LazyGhostTrait __construct() idiom.
• Updated rector.php to the Rector 2 API; CI now runs phpstan instead of psalm.

Add missing tests

• From 3 to 16 test files / 49 tests / 105 assertions, covering every previously-untested class.
• Calibrated with Infection to 100% MSI and 100% mutation code coverage; added a CI mutation-testing job gating at --min-msi=100 --min-covered-msi=100.

Misc

• Bumped LICENSE copyright year to 2026.

Test plan

• composer analyse (PHPStan) ✅
• composer phpunit (49 tests) ✅
• composer check-style (ECS) ✅
• vendor/bin/composer-dependency-analyser ✅
• vendor/bin/rector process --dry-run (clean) ✅
• composer validate --strict / composer normalize --dry-run ✅
• composer infection (100% MSI) ✅

Note: on PHP 8.4, the transitive dev dep thecodingmachine/safe emits E_DEPRECATED notices that break Infection's initial run (absent on CI's 8.1/8.2). Run locally with --initial-tests-php-options="-d error_reporting=24575". Documented in CLAUDE.md.